Security audit
Security checks for vulnerabilities and agentic risk
This skill is a plain Markdown guide for creating persistent subagent prompt files, with no executable code or hidden install behavior.
Before installing, understand that this skill helps create persistent subagent prompt files. Prefer project-level agents when the behavior is codebase-specific, review generated descriptions so proactive triggers are not too broad, and be cautious with examples that use external tools such as BigQuery by adding explicit scope and authorization rules.
The phrase "Use immediately after writing or modifying code" is expansive and likely to match routine development activity very frequently. It lacks exclusions or constraints that would help prevent unintended delegation on trivial edits.
The guidance to include "use proactively" promotes ambiguous activation conditions without defining boundaries or exclusions. This can cause subagents to be invoked in many ordinary situations rather than only in narrowly specified contexts.
The instruction "Use proactively when encountering any issues" is vague because "any issues" is not bounded and could include minor or unrelated problems. Without clearer criteria, the trigger may collide with many normal conversational contexts.
The data-scientist example explicitly instructs use of BigQuery command-line tools when appropriate, which can operate against real user credentials and external datasets from an agent prompt. In the context of a skill for creating reusable subagents, this increases the chance that a generated subagent will perform external, potentially stateful actions or access sensitive data without sufficient approval, scoping, or guardrails.
When invoked:
1. Understand the data analysis requirement
2. Write efficient SQL queries
3. Use BigQuery command line tools (bq) when appropriate
4. Analyze and summarize results
5. Present findings clearly
The phrase "Use proactively for data analysis tasks and queries" is somewhat general and does not specify what kinds of requests qualify or where the boundaries are. This increases the chance of unintended invocation for routine mentions of data or queries.
No suspicious patterns detected.